[mrgoonie]

Why

A personal kit that extends an official AgentKit kit (ak skills kit init --extends engineer@0.2.0) pins every foundation skill as an @agentkit/<x> release. SkillX verifies each pin against a release it serves and refuses the revision with kit.base_unavailable otherwise. Live check today: 103 of the 105 engineer bases answer 404. Only @agentkit/bro@0.2.0 and @agentkit/sumup@0.2.0 exist, and their digests match the current tree. As a result, no personal kit over engineer can be published (bestagentkits/agentkit#3043).

What

• .github/workflows/publish-agentkit-kit-mirror.yml runs only on dispatch from main. Inputs: agentkit-sha, kit, channel (default beta), only and dry-run.
  • plan job (no credentials): builds ak at the commit, runs ak skills kit init --extends <kit>@<version> and inspect --json in an isolated home, then builds the plan and uploads it as the kit-mirror-plan artifact.
  • publish job (skillx-publish environment): handles each entry in turn:
    • skips it when a release is already served at the same digest, and fails it when the served digest differs;
    • runs skillx pack and requires the digest AgentKit pins before any upload (with dry-run, the job stops here);
    • publishes with --kit-origin remote-signed, using OIDC first and falling back to SKILLX_AGENTKIT_KIT_PUBLISH_KEY, with a per-commit idempotency key;
    • checks that the served digest matches after publishing.
• Visibility: skills of a tier: free kit (kits/core) are published public. Skills of every other kit (paid engineer, marketing) are published private, so proprietary kit content never becomes public.
• scripts/agentkit-kit-mirror-plan.mjs is the validated planner: identity ↔ ak-<x> mapping, owner kit, sha256 digest, existing directory, duplicates and only. It is tested by scripts/agentkit-kit-mirror-plan.test.mjs.
• docs/deployment-guide.md gains step 8 covering trusted publisher or key setup, dispatch, and the visibility rule.

Verification

• node --test scripts/agentkit-kit-mirror-plan.test.mjs: 4/4 pass.
• The plan step body ran locally against real AgentKit dev:
  • engineer@0.2.0 → 105 entries (65 private engineer, 40 public core);
  • marketing@0.2.0 → 84 entries;
  • only narrows the plan, and an unknown id exits 1.
• bash -n passes on every run step, and the YAML parses.
• Not run here: pnpm install / vitest, and a real dispatch. The dispatch needs the owner's releases:publish:@agentkit credential.

Follow-ups

• Run the workflow with dry-run: true first, then for real, for engineer and marketing.
• Paid private releases are readable only by their owner until SkillX entitles AgentKit license holders to them (separate issue).

Refs bestagentkits/agentkit#3043

---

Generated by Claude Code